[hwasan] add stack frame descriptions.

[kcc]

Summary

At compile-time, create an array of {PC,HumanReadableStackFrameDescription}
for every function that has an instrumented frame, and pass this array
to the run-time at the module-init time.
Similar to how we handle pc-table in SanitizerCoverage.
The run-time is dummy, will add the actual logic in later commits.

[eugenis]

lib/Transforms/Instrumentation/HWAddressSanitizer.cpp

151

s/_/-

217

"fd" usually stands for file descriptor
Rename to __hwasan_frames?

319

This section should be read-only so the (intrusive) linked list idea would not work.

I don't think this slot helps you avoid a module pass. You can create a call to __hwasan_init_fd regardless.

You are inserting multiple calls to __hwasan_init_fd to the ctor function. Just one would be enough.

Ctor function should be comdat'ed itself, but that's orthogonal.

742

Why would F's name start with "hwasan"? Did you mean "__hwasan"?

[kcc]

addressed review comments

lib/Transforms/Instrumentation/HWAddressSanitizer.cpp

151

done.

217

renamed the section to hwasan_frames and the callback to hwasan_init_frames

319

Ok, won't use the (intrusive) linked list.

You are inserting multiple calls to __hwasan_init_fd to the ctor function.

Nope. This code is in HWAddressSanitizer::doInitialization(Module &M)

Ctor function should be comdat'ed itself, but that's orthogonal.

Yep, will do separately.

742

No, this one is for the CTOR (HwasanCtorFunction above)

[morehouse]

lib/Transforms/Instrumentation/HWAddressSanitizer.cpp

318

Why do we need a frame description for the ctor in order to call it?

[kcc]

lib/Transforms/Instrumentation/HWAddressSanitizer.cpp

318

We don't.
This call is here to ensure that the section is not empty and that we can create __start_SECTION for it.
Otherwise, we will need to refactor the code to make it a ModulePass instead of a FunctionPass (which is unwelcome).
I don't know any other way to handle this in a FunctionPass. :(

[eugenis]

lib/Transforms/Instrumentation/HWAddressSanitizer.cpp

742

Why not compare F with HwasanCtorFunction?

[kcc]

address one more comment

lib/Transforms/Instrumentation/HWAddressSanitizer.cpp

742

Yep, done.

[eugenis]

Please rename the remaining FD's.
LGTM then.

lib/Transforms/Instrumentation/HWAddressSanitizer.cpp

 #include "llvm/Support/Casting.h"
 #include "llvm/Support/CommandLine.h"
 #include "llvm/Support/Debug.h"
 #include "llvm/Support/raw_ostream.h"
 #include "llvm/Transforms/Instrumentation.h"
 #include "llvm/Transforms/Utils/BasicBlockUtils.h"
 #include "llvm/Transforms/Utils/ModuleUtils.h"
 #include "llvm/Transforms/Utils/PromoteMemToReg.h"
+#include <sstream>
 
 using namespace llvm;
 
 #define DEBUG_TYPE "hwasan"
 
 static const char *const kHwasanModuleCtorName = "hwasan.module_ctor";
 static const char *const kHwasanInitName = "__hwasan_init";
 
cl::desc("Access dynamic shadow through an thread-local pointer on "
              "platforms that support this"),
     cl::Hidden, cl::init(true));
 
 static cl::opt<bool>
     ClRecordStackHistory("hwasan-record-stack-history",
                          cl::desc("Record stack frames with tagged allocations "
                                   "in a thread-local ring buffer"),
                          cl::Hidden, cl::init(true));
+static cl::opt<bool>
+    ClCreateFrameDescriptions("hwasan_create_frame_descriptions",
+                              cl::desc("create static frame descriptions"),
+                              cl::Hidden, cl::init(true));
+
 namespace {
 
 /// An instrumentation pass implementing detection of addressability bugs
 /// using tagged pointers.
 class HWAddressSanitizer : public FunctionPass {
 public:
   // Pass identification, replacement for typeid.
   static char ID;
Value *getAllocaTag(IRBuilder<> &IRB, Value *StackTag, AllocaInst *AI,
                      unsigned AllocaNo);
   Value *getUARTag(IRBuilder<> &IRB, Value *StackTag);
 
   Value *getHwasanThreadSlotPtr(IRBuilder<> &IRB, Type *Ty);
   Value *emitPrologue(IRBuilder<> &IRB, bool WithFrameRecord);
 
 private:
   LLVMContext *C;
+  std::string CurModuleUniqueId;
   Triple TargetTriple;
 
+  // FD (frame description) is a way to pass names/sizes of local variables
+  // to the run-time w/o adding extra executable code in every function.
+  // We do this by creating a separate section with {PC,Descr} pairs and passing
+  // the section beg/end to __hwasan_init_fd() at module init time.
+  std::string createFDString(ArrayRef<AllocaInst*> Allocas);
+  void createFD(Function &F, const std::string &FDString);
+  // Get the section name for FD. Currently ELF-only.
+  const char *getFDSection() { return "__hwasan_fd"; }
+  const char *getFDSectionBeg() { return  "__start___hwasan_fd"; }
+  const char *getFDSectionEnd() { return  "__stop___hwasan_fd"; }
+  GlobalVariable *createFDSectionBound(Module &M, Type *Ty, const char *Name) {
+    auto GV = new GlobalVariable(M, Ty, false, GlobalVariable::ExternalLinkage,
+                                 nullptr, Name);
+    GV->setVisibility(GlobalValue::HiddenVisibility);
+    return GV;
+  }
+
   /// This struct defines the shadow mapping using the rule:
   ///   shadow = (mem >> Scale) + Offset.
   /// If InGlobal is true, then
   ///   extern char __hwasan_shadow[];
   ///   shadow = (mem >> Scale) + &__hwasan_shadow
   /// If InTls is true, then
   ///   extern char *__hwasan_tls;
   ///   shadow = (mem >> Scale) + align_up(__hwasan_shadow, kShadowBaseAlignment)
bool HWAddressSanitizer::doInitialization(Module &M) {
   LLVM_DEBUG(dbgs() << "Init " << M.getName() << "\n");
   auto &DL = M.getDataLayout();
 
   TargetTriple = Triple(M.getTargetTriple());
 
   Mapping.init(TargetTriple);
 
   C = &(M.getContext());
+  CurModuleUniqueId = getUniqueModuleId(&M);
   IRBuilder<> IRB(*C);
   IntptrTy = IRB.getIntPtrTy(DL);
   Int8PtrTy = IRB.getInt8PtrTy();
   Int8Ty = IRB.getInt8Ty();
 
   HwasanCtorFunction = nullptr;
   if (!CompileKernel) {
     std::tie(HwasanCtorFunction, std::ignore) =
         createSanitizerCtorAndInitFunctions(M, kHwasanModuleCtorName,
                                             kHwasanInitName,
                                             /*InitArgTypes=*/{},
                                             /*InitArgs=*/{});
     appendToGlobalCtors(M, HwasanCtorFunction, 0);
   }
+
+  // Create a call to __hwasan_init_fd.
+  if (HwasanCtorFunction) {
+    // Create a dummy FD for the CTOR function.
+    // * it gives us an empty slot in the FD section to use for a linked list.
+    // * w/o it we would have to create the call to __hwasan_init_fd after
+    //   all functions are instrumented (i.e. need to have a ModulePass).
+    createFD(*HwasanCtorFunction, "");
+    IRBuilder<> IRBCtor(HwasanCtorFunction->getEntryBlock().getTerminator());
+    IRBCtor.CreateCall(declareSanitizerInitFunction(M, "__hwasan_init_fd",
+                                                    {Int8PtrTy, Int8PtrTy}),
+                       {createFDSectionBound(M, Int8Ty, getFDSectionBeg()),
+                        createFDSectionBound(M, Int8Ty, getFDSectionEnd())});
+  }
+
   if (!TargetTriple.isAndroid())
     appendToCompilerUsed(
         M, ThreadPtrGlobal = new GlobalVariable(
                M, IntptrTy, false, GlobalVariable::ExternalLinkage, nullptr,
                "__hwasan_tls", nullptr, GlobalVariable::InitialExecTLSModel));
 
   return true;
 }
Value *HWAddressSanitizer::getHwasanThreadSlotPtr(IRBuilder<> &IRB, Type *Ty) {
   }
   if (ThreadPtrGlobal)
     return ThreadPtrGlobal;
 
 
   return nullptr;
 }
 
+// Creates a string with a description of the stack frame (set of Allocas).
+// The string is intended to be human readable.
+// The current form is: Size1 Name1; Size2 Name2; ...
+std::string HWAddressSanitizer::createFDString(ArrayRef<AllocaInst *> Allocas) {
+  std::ostringstream Descr;
+  for (auto AI : Allocas)
+    Descr << getAllocaSizeInBytes(*AI) << " " <<  AI->getName().str() << "; ";
+  return Descr.str();
+}
+
+// Creates a global in the FD section which consists of two pointers:
+// the function PC and the FD string constant.
+void HWAddressSanitizer::createFD(Function &F, const std::string &FDString) {
+  Module &M = *F.getParent();
+  auto DescrGV = createPrivateGlobalForString(M, FDString, true);
+  auto PtrPairTy = StructType::get(F.getType(), DescrGV->getType());
+  auto GV = new GlobalVariable(
+      M, PtrPairTy, /*isConstantGlobal*/ true, GlobalVariable::PrivateLinkage,
+      ConstantStruct::get(PtrPairTy, (Constant *)&F, (Constant *)DescrGV),
+      "__hwasan");
+  GV->setSection(getFDSection());
+  appendToCompilerUsed(M, GV);
+  // Put GV into the F's Comadat so that if F is deleted GV can be deleted too.
+  if (!F.getName().startswith("hwasan"))
+    if (auto Comdat = GetOrCreateFunctionComdat(F, CurModuleUniqueId))
+      GV->setComdat(Comdat);
+}
+
 Value *HWAddressSanitizer::emitPrologue(IRBuilder<> &IRB,
                                         bool WithFrameRecord) {
   if (!Mapping.InTls)
     return getDynamicShadowNonTls(IRB);
 
   Value *SlotPtr = getHwasanThreadSlotPtr(IRB, IntptrTy);
   assert(SlotPtr);
 
for (auto &Inst : BB) {
       if (Addr || isa<MemIntrinsic>(Inst))
         ToInstrument.push_back(&Inst);
     }
   }
 
   if (AllocasToInstrument.empty() && ToInstrument.empty())
     return false;
 
+  if (ClCreateFrameDescriptions && !AllocasToInstrument.empty())
+    createFD(F, createFDString(AllocasToInstrument));
+
   initializeCallbacks(*F.getParent());
 
   assert(!LocalDynamicShadow);
 
   Instruction *InsertPt = &*F.getEntryBlock().begin();
   IRBuilder<> EntryIRB(InsertPt);
   LocalDynamicShadow = emitPrologue(EntryIRB,
                                     /*WithFrameRecord*/ ClRecordStackHistory &&

projects/compiler-rt/lib/hwasan/hwasan.cc

void UpdateMemoryUsage() {
   HwasanFormatMemoryUsage(s);
   internal_strncpy(memory_usage_buffer, s.data(), kMemoryUsageBufferSize - 1);
   memory_usage_buffer[kMemoryUsageBufferSize - 1] = '\0';
 }
 #else
 void UpdateMemoryUsage() {}
 #endif
 
+struct FrameDescription {
+  uptr PC;
+  const char *Descr;
+};
+
+void InitFrameDescriptors(uptr b, uptr e) {
+  FrameDescription *beg = reinterpret_cast<FrameDescription *>(b);
+  FrameDescription *end = reinterpret_cast<FrameDescription *>(e);
+  // Must have at least one entry, which we can use for a linked list.
+  CHECK_GE(end - beg, 1U);
+  if (Verbosity()) {
+    for (FrameDescription *fd = beg; fd < end; fd++)
+      Printf("FD: %p %s\n", fd->PC, fd->Descr);
+  }
+}
+
 } // namespace __hwasan
 
 // Interface.
 
 using namespace __hwasan;
 
 uptr __hwasan_shadow_memory_dynamic_address;  // Global interface symbol.
 
 void __hwasan_shadow_init() {
   if (hwasan_shadow_inited) return;
   if (!InitShadow()) {
     Printf("FATAL: HWAddressSanitizer cannot mmap the shadow memory.\n");
     DumpProcessMap();
     Die();
   }
   hwasan_shadow_inited = 1;
 }
 
+void __hwasan_init_fd(uptr beg, uptr end) {
+  InitFrameDescriptors(beg, end);
+}
+
 void __hwasan_init() {
   CHECK(!hwasan_init_is_running);
   if (hwasan_inited) return;
   hwasan_init_is_running = 1;
   SanitizerToolName = "HWAddressSanitizer";
 
   InitTlsSize();
 

projects/compiler-rt/lib/hwasan/hwasan_interface_internal.h

 using __sanitizer::uu32;
 using __sanitizer::uu16;
 using __sanitizer::u64;
 using __sanitizer::u32;
 using __sanitizer::u16;
 using __sanitizer::u8;
 
 SANITIZER_INTERFACE_ATTRIBUTE
+void __hwasan_init_fd(uptr, uptr);
+
+SANITIZER_INTERFACE_ATTRIBUTE
 extern uptr __hwasan_shadow_memory_dynamic_address;
 
 SANITIZER_INTERFACE_ATTRIBUTE
 void __hwasan_loadN(uptr, uptr);
 SANITIZER_INTERFACE_ATTRIBUTE
 void __hwasan_load1(uptr);
 SANITIZER_INTERFACE_ATTRIBUTE
 void __hwasan_load2(uptr);

test/Instrumentation/HWAddressSanitizer/basic.ll

entry:
   %b = load i8, i8 addrspace(256)* %a, align 4
   ret i8 %b
 }
 
 ; CHECK: declare void @__hwasan_init()
 
 ; CHECK:      define internal void @hwasan.module_ctor() {
 ; CHECK-NEXT:   call void @__hwasan_init()
+; CHECK-NEXT:   call void @__hwasan_init_fd(
 ; CHECK-NEXT:   ret void
 ; CHECK-NEXT: }

test/Instrumentation/HWAddressSanitizer/frame-descriptor.ll

+; Test frame descriptors
+;
+; RUN: opt < %s -hwasan -S | FileCheck %s
+
+target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
+target triple = "aarch64--linux-android"
+
+declare void @use32(i32*, i64*)
+
+define void @test_alloca() sanitize_hwaddress {
+entry:
+  %XYZ = alloca i32, align 4
+  %ABC = alloca i64, align 4
+  call void @use32(i32* nonnull %XYZ, i64 *nonnull %ABC)
+  ret void
+}
+
+; CHECK: @[[STR:[0-9]*]] = private unnamed_addr constant [15 x i8] c"4 XYZ; 8 ABC; \00", align 1
+; CHECK: private constant { void ()*, [15 x i8]* } { void ()* @test_alloca, [15 x i8]* @[[STR]] }, section "__hwasan_fd", comdat($test_alloca)
+
+; CHECK-LABEL: @test_alloca(
+; CHECK: ret void
+
+; CHECK-LABEL: @hwasan.module_ctor
+; CHECK: call void @__hwasan_init_fd(i8* @__start___hwasan_fd, i8* @__stop___hwasan_fd)
+; CHECK: ret void
+

test/Instrumentation/HWAddressSanitizer/with-calls.ll

entry:
   %b = load i8, i8 addrspace(256)* %a, align 4
   ret i8 %b
 }
 
 ; CHECK: declare void @__hwasan_init()
 
 ; CHECK:      define internal void @hwasan.module_ctor() {
 ; CHECK-NEXT:   call void @__hwasan_init()
+; CHECK-NEXT:   call void @__hwasan_init_fd(
 ; CHECK-NEXT:   ret void
 ; CHECK-NEXT: }